We have thousands of posts on a wide variety of open source and security topics, conveniently organized for searching or just browsing.
Facebook's Magma brings open-source mobile cores to carrier-grade LTE and 5G. Moving ahead, Magma will run with the Linux Foundation using a vendor-neutral governance framework.
CrowdSec is (and will always remain) an open-source & free security solution able to analyze visitor behavior & provide an adapted response to all kinds of attacks. The solution also enables users to protect each other. Each time an IP is blocked, all community members are informed so they can also block it.
When it comes to modern applications, did you know that up to 80% of code is made up of open-source components? There are several reasons why open-source software is utilized, including its cost-effective nature, reliability, and the freedom to access, modify, and distribute source codes.
Yet, the nature of open-source components means security efforts can be overlooked. After all, developers usually take components which are readily available and implement them within their own projects. This saves considerable time where they gain useful features without having to write their own code. It also means exploits can exist – and these can be easily missed when working on applications.
There are plenty of examples where an organization has been devastated by lackadaisical open-source security. The most infamous was back in September 2017. Equifax, the international credit reporting agency, suffered a hack on an unprecedented scale. The open-source component known as Apache Struts2 featured an exploit, and this was all it took for attackers to make off with the personal data of at least 143 million people.
As a result, it is essential your organization doesn’t just detect vulnerabilities in open-source code, but also rectifies any issues before they cause damage. This is where WhiteSource can take center stage for your Linux projects.
Open-source security relies on a community-based approach. SAST and other technology for application security testing are beneficial for proprietary code, but it’s a different story with Open Source. The community is very much a resource for identifying and fixing vulnerabilities found within code.
However, even though the open-source community is capable of devising fixes for vulnerabilities, there’s one point to remember: Open Source isn’t controlled by one authority. It is a decentralized operation. This means information about vulnerabilities/fixes is spread across various resources, which ultimately results in it being impossible for organizations to match these to their own applications.
So how can a corporation keep its open-source inventory secure? To avoid a potential ticking time bomb due to vulnerable components, one of the best solutions on the market is WhiteSource.
In essence, WhiteSource allows you to automatically check every open-source component found within your applications. By doing this, you can stay secure from vulnerabilities while also enforcing all license policies during the development lifecycle of your software. Along with staying secure from hackers, it also results in faster, smoother, and more affordable development.
The following points will go through the steps the WhiteSource platform takes to keep software safe, and why 1.3 million developers use it for their projects.
As mentioned already, even with community feedback, it’s difficult to know which of your open-source components feature any vulnerabilities. WhiteSource can rectify that issue – and go beyond any manual application checks. The platform detects any vulnerability in an application, including those found in your transitive dependencies, and does this across 200+ programming languages.
Along with this comprehensive database, WhiteSource cuts out those resource-eating false positives. Plus, the platform’s patented Effective Usage Analysis tool ensures your development team can prioritize the vulnerabilities that truly need resolving.
When a vulnerability has been detected, it’s essential that it is corrected as soon as possible. When the community issue trackers list a vulnerability, hackers are quick to react in an effort to exploit the security flaw. Due to remediation requiring the cooperation of your developers and security teams, a swift fix for vulnerabilities is not always possible – especially if they’re working on code they didn’t write themselves.
With WhiteSource; however, you can accurately pinpoint any vulnerable functionality found within your code. It also maps out how your application is using the vulnerability. With these insights, you can significantly reduce your remediation efforts.
WhiteSource adds further convenience by suggesting fixes for any vulnerability. Whether this is a configuration change to the system blocking a certain function or a link to the latest patches, the platform lists all known remedies. WhiteSource also automates the process for every new issue discovered.
When you factor in the sheer size of the open source community in terms of data and combine this with its decentralized nature, it is practically impossible to manage every facet of open-source security manually. This is why an automated solution like WhiteSource is so vital for the process.
When it comes to monitoring, it is vital to combine shift right and shift left testing.
The “shift right” methodology is particularly imperative as open-source project vulnerabilities are usually found years after the release of the vulnerable version. The good news: WhiteSource keeps automatic track of the latest deployed version of a component.
As for “shift left”, this approach allows developers to spot vulnerable components prior to them even being downloaded from the Internet. WhiteSource’s browser extension, Web Advisor, ensures developers can pick the most suitable component right from the start.
WhiteSource also enables you to automatically enforce quality/security/license compliance policies throughout the software development life cycle. By automating this aspect, you can save considerable time and resources compared to manually reviewing new components.
